Kimi Code Review: Desktop, CLI, Pricing, and Risks

This Kimi Code review examines Moonshot AI's coding agent just after Kimi Code Desktop launched on September 17, 2026. The product now spans a graphical desktop app, an open-source terminal client, a VS Code extension, and connections to compatible editors and model providers. That breadth makes it a credible alternative for developers who want more choice than a single closed model-and-interface bundle.

The important question is not whether Kimi Code can edit files or run commands; most modern coding agents can. The decision turns on workflow, model access, permissions, pricing, reliability, and the trust you place in plugins, skills, repositories, and remote services. This article is based on current documentation, source code, release notes, and limited independent evidence. It does not claim hands-on testing.

Kimi Code Review: Quick Verdict

Kimi Code is worth testing if you want one agent core across a desktop interface and terminal, value an MIT-licensed CLI, or need to connect Kimi and compatible third-party models. Its practical strengths include visible tool activity, change review, plan and goal modes, subagents, skills, plugins, MCP support, video input, and Agent Client Protocol integration with supported editors.

The cautious verdict is that Kimi Code looks capable but still needs a controlled pilot. The desktop app is only days old. The official changelog documents rapid development, including recent security fixes and behavior changes. Pricing and model entitlements depend on region and plan, while unattended permission modes can expose files and shell access. Start in a disposable repository, keep the default approval mode, and compare accepted changes rather than promotional benchmarks.

What Is Kimi Code?

Kimi Code is Moonshot AI's agentic software-development product. The agent can inspect a repository, edit files, run shell commands, search code, fetch web pages, and use the results of those actions to choose its next step. It is a harness around models, tools, permissions, context, and interfaces—not a model itself.

That distinction prevents confusion with Kimi K3. K3 is a model that can power coding workflows; Kimi Code is the client and agent system that organizes the work. SD's Kimi K3 review covers model-level pricing, benchmarks, and open-weight questions separately.

Kimi Code currently has four main surfaces:

• Desktop for a visual project, conversation, changes, file-preview, and terminal workflow on macOS and Windows.
• CLI for terminal-first sessions, scripting, remote control, and deeper configuration.
• VS Code for developers who want the agent inside an editor.
• ACP integrations that let compatible clients such as Zed or JetBrains drive the CLI over standard input and output.

The CLI is published under the MIT license. That does not make the official models, hosted inference, desktop client, or every plugin open source.

Kimi Code Desktop and CLI Features

Desktop Makes Agent Work Easier to Inspect

Kimi Code Desktop brings the CLI's agent core into a graphical application. A user chooses a local workspace, sends a task, and can inspect tool calls, thinking, changed files, previews, and terminal output. Plan mode proposes an approach before code changes. Goal mode keeps a longer objective moving, while background tasks and subagents handle parallel or extended work.

The interface lowers the barrier for developers who do not want to manage every agent session in a terminal. It does not remove the need to understand the diff. File previews and a successful command are review aids, not proof that a change is correct, secure, or maintainable.

CLI Offers the Deeper Automation Surface

The CLI installs as a single binary and supports sessions, context compaction, undo, model switching, images, and video. It can load skills, plugins, MCP servers, lifecycle hooks, custom agents, and project instructions. Remote Control exposes a running local session through a browser while execution remains on the developer's computer.

This flexibility is Kimi Code's strongest differentiator and a source of risk. Every added tool, plugin, skill, or MCP server can expand what the agent sees and does. Treat third-party extensions and repository instructions as code dependencies: inspect the source, pin trusted versions where possible, and grant only the permissions required for the task.

Model Choice Is Useful but Complicates Comparisons

Signed-in users can choose official models allowed by their membership. Desktop also supports manually configured providers using an API key, base URL, protocol, and model details. The CLI can use Kimi models or compatible providers.

This means a statement such as “Kimi Code is better” is incomplete without naming the model, context size, permission mode, tool configuration, and task. A strong result may come from the model, the harness, or both. Compare agents with the same repository snapshot, acceptance tests, and review rules. SD's Claude Code vs Codex comparison explains why workflow-level evaluation matters.

Kimi Code Pricing and Usage Limits

Kimi Code pricing is not one universal global rate. The current mainland-China membership page lists four paid tiers—Andante at ¥49 per month, Moderato at ¥99, Allegretto at ¥199, and Allegro at ¥699—and says Kimi Code is available across them. All Kimi products draw from a shared credit pool based on actual token use, and Kimi Code also has a separate five-hour-per-week usage limit.

The desktop documentation says official Kimi models are not directly available without a membership, although users can connect a third-party provider. Model entitlements and context limits vary by plan. International names, currencies, promotions, and quotas may differ, so buyers should treat the price shown in their account as authoritative.

The real cost can include membership, external API usage, long-context tokens, retries, and developer review. A useful pilot records completed tasks, wall-clock time, tokens or credits, failed attempts, regressions, and human correction time. Low subscription cost does not help if an agent produces more rework.

Kimi Code Security and Permissions

Kimi Code has three permission modes. Always Ask is the default: read-only operations can proceed, while edits and commands request approval. Ask When Needed runs routine operations automatically but still asks for sensitive actions. Never Ask handles every approval automatically, including sensitive files and plan exits.

The built-in dangerous-command guard is enabled by default, but the documentation says it is not active in Never Ask mode. Users can also disable it in configuration. That makes unattended operation a deliberate security decision, not a convenience toggle. For unfamiliar repositories, use Always Ask, exclude secret-bearing directories, commit or back up work first, and review exact commands before approval. SD's AI agent security guide provides a wider deployment checklist.

Local state deserves attention too. Kimi Code stores configuration, session history, OAuth credentials, MCP credentials, plugins, logs, and other runtime data under ~/.kimi-code/ by default. Teams should protect that directory, separate work contexts when needed, and include it in endpoint-security and offboarding procedures.

The changelog is evidence of active maintenance and ongoing risk. Recent releases fixed a bearer-token bypass involving encoded API paths and a filesystem API issue that could follow symlinks outside the workspace. The repository says only the latest release receives security support. Those fixes are reasons to update promptly, not proof that the agent is unsafe or secure in every deployment.

Kimi Code Limitations

The largest limitation is evidence. Kimi Code Desktop is new, and independent, reproducible testing of its reliability, security boundaries, and cost per accepted change is limited. One September evaluation rated the Kimi K3 and Kimi Code combination positively but described it as slower and more verbose than mature competitors. That is a useful observation from one review, not a universal benchmark.

Fast releases also create operational churn. Configuration formats, model availability, permissions, plugins, and UI behavior can change. The release history includes migrations from an older CLI, fixes for session problems, and security patches. Teams should test upgrades before rolling them across developer machines.

Finally, Kimi Code's extensibility widens its attack surface. Skills and project instructions are natural-language programs; plugins and MCP servers can add credentials and actions; repositories can contain hostile content. General research on coding-agent skill attacks has shown high exploit rates in other agents, although it did not test Kimi Code. The reasonable inference is to isolate agents and distrust inputs, not to transfer another product's measured result to Kimi.

Who Should Use Kimi Code?

Kimi Code best fits developers willing to test a fast-moving agent, teams that value an open-source terminal client, and users who want Desktop and CLI workflows around Kimi or compatible models. Video input, ACP support, subagents, and a broad extension system may be especially useful for multimodal debugging and custom developer environments.

Wait or proceed cautiously if you need mature independent validation, stable enterprise controls, fully local inference, or predictable global pricing. Teams seeking a hosted coordination layer around multiple agents can also compare SD's Cobalt coding agent review. Organizations handling sensitive repositories should confirm current data terms for the exact account and provider path they use. Kimi's API documentation says API inputs and outputs are not used for model training, but that statement should not be assumed to cover every membership, desktop, plugin, or third-party-provider workflow.

A sensible evaluation starts with three bounded tasks: explain an unfamiliar module without changes, fix a test-backed defect, and implement a small feature with explicit acceptance criteria. Run the existing test suite, inspect every diff, scan dependencies, and compare the result with another agent. Keep deployment, merging, credential access, and external communication behind human approval.

Conclusion

This Kimi Code review finds a flexible, rapidly evolving coding agent with a promising new desktop interface and a notably open CLI. Its strongest case is workflow choice: users can move between graphical and terminal sessions, connect different models, inspect changes, and extend the agent with skills, plugins, MCP, hooks, and subagents.

That same flexibility requires restraint. The desktop client has little independent track record, plan rules vary, recent releases include security fixes, and unattended permissions can give the agent broad file and shell access. Kimi Code deserves a place in a controlled coding-agent evaluation, but the decision should rest on accepted changes, total cost, and security controls—not feature count alone.